Privacy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

No account, no tracking

No sign-up, no login, no profile. The app has never asked for your name or your email address and does not have either.

Neither the app nor this site sets cookies, runs analytics, shows advertising or collects an advertising identifier. Nothing is shared with data brokers, and the app never asks for tracking permission because there is nothing to track.

Your areas

Areas sync between your iPhone, iPad and Mac through your own private iCloud database. It is your Apple account, not ours: we cannot read it, and Apple processes it under its own privacy policy. Without iCloud, everything stays on the device.

The AI features

When you describe an area, ask for tips or ask for a dinner, the request carries only what it needs: the sentence you typed or the task names in the area, plus an anonymous token that says credits are available. No name, no device identifier, no location, no history.

Our server in Frankfurt passes the sentence or the item names to Anthropic, PBC (San Francisco, USA), whose model writes the answer. We store neither the request nor the answer, and Anthropic does not use them to train its models. The transfer to the USA rests on the EU standard contractual clauses. Legal basis: performance of our contract with you, Art. 6(1)(b) GDPR.

What stays on the server is a credit balance against that random token. The token names no person and no device, leaves with the app when you delete it, and we delete the balance on request.

Agents

Off until you turn it on. While it is on, our server keeps a copy of your areas so an agent such as ChatGPT or Claude can read them, and a queue of the changes an agent asks for, which your own device carries out. The copy is keyed by a random account token: no name, no email address, no device identifier.

The copy lives as long as the switch is on. A request an agent made is deleted seven days after your device has answered it, a sign-in for the app or an agent expires after 180 days at most, a pairing code after ten minutes and an authorisation code after five. Turning the switch off deletes the copy, the queue and every sign-in at once.

The agent you connect receives what it reads, under the terms of its own provider. Legal basis: your consent, given by turning the switch on and withdrawn by turning it off, Art. 6(1)(a) GDPR.

Purchases

The App Store handles every payment. We never see your name, address or payment details. To credit a purchase, the app sends us Apple's signed transaction, and we keep its transaction number against your credit balance so that no purchase is credited twice. Legal basis: Art. 6(1)(b) GDPR.

Support

If you write to us through the support form, we hold your email address and your message for up to 24 hours until you confirm them from your inbox; unconfirmed messages are deleted automatically. A confirmed message is delivered to our mailbox and kept as long as the conversation needs it and any statutory retention period requires. To limit abuse, the form keeps a counter under a hash of your IP address for fifteen minutes. Legal basis: Art. 6(1)(b) and (f) GDPR.

Hosting

This site and our server run on Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) in Frankfurt, Germany. To deliver a page or answer a request, AWS processes the IP address of your device for the duration of the request; we keep no access logs. A data processing agreement under Art. 28 GDPR is in place with AWS. Legal basis: our legitimate interest in running the service securely, Art. 6(1)(f) GDPR.

Changes

We update this notice when the app changes what it does with your data, and change the date below whenever the text changes.

Your rights

Under the GDPR you have the right to:

• access to your data (Art. 15)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• object to processing (Art. 21)
• withdraw a consent you have given, with effect for the future (Art. 7(3))

An informal message to info@sp33c.tech or through the Support is enough. Because there is no account, tell us what to look for: a message you sent to support, or the agent access you had turned on.

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR). The one responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.